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Abstract 

We  have  developed  a  hierarchical  hybrid  system  architecture  with  inputs  for  multiple  satellite 
control.  We  re-developed  the  hierarchical  hybrid  automaton  of  all  three  tiers  incorporating  the 
input  variables.  Then  we  investigated  the  dynamical  properties  of  the  hybrid  system.  We  defined 
nonblocking,  backward  reachability,  forward  reachability,  equilibrium,  and  stability  properties. 
We  used  backward  reachability  concept  to  solve  an  autonomous  collision  avoidance  application. 
In  collision  avoidance  problem,  the  satellites  autonomously  determine  the  possibility  of  the 
collision  and  change  the  orbit  in  order  to  avoid  collision.  We  have  developed  a  Matlab  code  for 
coplanar  collision  avoidance  problem.  The  solution  was  obtained  using  the  backward 
reachability  concept  and  game  theory.  The  game  problem  was  solved  using  the  level  set  method. 
On  the  low  level  control,  we  have  developed  statistical  game  control  theory.  For  the  two  player 
stochastic  game  problem,  we  developed  the  optimal  solution.  We  applied  this  statistical  game 
idea  to  a  satellite  attitude  control.  We  used  a  commercial  satellite  attitude  model  developed  by 
the  PI  in  the  past,  and  applied  statistical  control  theory  to  control  the  attitude  of  the  satellite.  We 
found  out  that  this  idea  generalizes  stochastic  H-infinity  controller.  We  obtained  performance 
and  stability  tradeoff  with  an  extra  degree  of  freedom  using  statistical  game  theory.  We  presented 
these  results  in  American  Control  Conference;  and  Control  and  Decision  Conference. 
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Hierarchical  Hybrid  System  Model 

Hybrid  Automaton 

A  hybrid  automaton  H  can  be  described  mathematically  as, 

H=(Q,X,  I„„  I„„,  ,U,f,Init,Inv,E,G,R) 

where 

Q  Finite  set  of  discrete  states  of  H  ; 

X  Finite  set  of  continuous  variables; 

Finite  set  of  discrete  input  variables; 

Eou,  Finite  set  of  discrete  output  variables; 

U  Set  of  the  continuous  input  variables; 

/  :Qx  XxY.mxU  ->  tx  Vector  field,  defining  the  continuous  flow  in  discrete  state; 

Init  cQx  X  Set  of  initial  states; 

Inv :  Q  — » P(X)  Invariant  sets; 

EqQxQ  Set  of  edges; 

G :  E  -►  P(X)*U xlm  Guard  condition; 

R\  ExX  — >  P(X)  Reset  map. 

The  set  Q  is  simply  the  set  of  discrete  states  where  the  system  is  allowed  to  exist.  The 
set  X  will  represent  all  of  the  continuous  variables  that  are  possible  in  each  of  the  states  of 
Q.  The  vector  field,  /  usually  consists  of  time  dependent  functions  such  as  differential 
equations  that  describe  how  each  of  the  variables  in  X  changes  over  time.  TX  denotes 
the  tangent  bundle  of  X.  The  initial  states  are  simply  the  initial  values  of  the  continuous 
variables.  The  invariant  set,  Inv,  denotes  the  set  where  each  continuous  variable  belongs 
to  as  long  as  the  discrete  state  remains  in  qeQ.  The  invariant  set  is  also  called  the 

domain.  P(X)  denotes  the  set  of  all  subsets  of  X .  and  Z0B(  denote  the  set  of  all 


discrete  inputs  and  discrete  outputs.  U  is  the  set  of  all  continuous  input  variables  which 
includes  both  controllable  inputs  and  uncontrollable  inputs  (disturbances).  The  set  of 
edges,  E,  describe  what  transitions  are  allowed  to  occur  between  states.  The  guard 
conditions,  G,  describe  the  events  that  must  occur  for  a  transition  to  take  place.  Finally, 
the  reset  map,  R ,  is  the  set  of  conditions  that  cause  the  system  to  enter  its  initial  state. 

We  can  model  Ground  Control  Station  automaton  using  discrete  event  system 
modelling,  there  are  four  discrete  states  qx  ,  q2  ,  q2  ,  and  qA  ,  therefore 

£?  =  {<?.  <?2  <73  ^4}.  Where 

•  g, :  Idle  State.  In  this  state,  GCS  waits  for  the  command  parameters  including  the 

mission  start  time,  mission  altitude,  longitude  and  latitude  of  the  target  area.  If  GCS 
receives  the  command  parameters,  it  will  generate  the  GCSCommand  and  output 
this  command  to  Mother-ship  and  then  system  will  switch  from  qt  to  q2  , 

MissionScheduleStatusCheck  State.  If  GCS  receives  a  ranging  request  from  a 
target  satellite,  then  the  system  will  do  the  ranging  to  the  target  satellite,  send  the 
ranging  correction  command  and  jump  from  Idle  state  <7,  to  Ranging_Correction  State 

•  q2:  Mission_Schedule_Status_Check  State.  In  this  state,  the  ground  control  station 
waits  for  the  mission  schedule  status  message  from  the  Mother-ships.  If  at  least  one 
Mother-ship  sends  back  scheduling  success  message  via  the  MS/_Schedule#_Finish 
event,  that  means  the  Mother-ships  /  have  parsed  the  GCS  Command  and  distribute 
the  mission  to  the  proper  clusters.  The  system  will  then  jump  to  q2  , 


TaskStatusCheck  State,  if  the  tags  MS/'_Schedule#_Finish  =  1  are  received  for  all  /', 
showing  that  the  command  has  been  successfully  scheduled.  The  is  going  to 
represent  the  command  number  so  that  there  can  be  more  than  one  command  in  the 
operation.  If  system  receives  a  Ranging  Request  from  a  target  satellite  (can  be  either 
Mother-ship  or  Agent),  the  system  will  jump  from  q2  to  qA ,  RangingCorrection 

State,  and  sends  the  ranging  correction  information  to  the  satellite  which  sent  the 
request. 

q2 :  Task  Status  Check  State.  In  this  state,  the  system  will  wait  for  the  feedback 

from  Mother-ships  indicating  the  status  of  the  mission.  If  the  scheduled  mission  has 
been  successfully  performed  by  some  clusters,  Mother-ships  of  the  corresponding 
clusters  will  send  a  feedback  message,  which  is  called  Task#_Status_OK  tag,  to  GCS. 
The  will  be  the  mission  number.  If  Task#_Status_OK  =  1,  it  means  that  the 
mission  was  accomplished  so  that  the  system  will  jump  back  to  Idle  state  qx  and 

waiting  for  the  new  mission  command.  If  the  Task#_Status_OK  =  0,  it  means  the 
mission  number,  #,  failed  during  the  last  operation.  The  operator  may  send  another 
GCSCommand  at  this  point  and  jump  to  Mission  Schedule  Status  Check  State,  q2 

to  let  the  Mother-ships  reschedule  the  mission.  If  in  state  q2 ,  GCS  receives  a  ranging 

request  from  a  target  satellite,  then  the  system  will  do  the  ranging  to  the  target 
satellite,  send  the  ranging  correction  command  and  jump  to  Ranging  Correction  state 

^4- 

q4 :  Ranging  Correction  State.  In  this  state,  GCS  waits  for  the  feedback  message 
from  the  target  (Mother-ship  or  Agent)  which  requests  a  ranging  correction.  If  the 


target  sends  back  a  message  that  RangingStatusOK  =1,  which  means  that  the  target 
successfully  corrects  its  altitude  error,  then,  the  system  will  jump  back  to  the  previous 
state  where  it  transited  from.  If  Ranging_Status_OK  =0,  the  system  will  stay  in 
Ranging  Correction  State  until  a  message  Ranging  Status  OK  =1  shows  up  or  a 
TimeOut  event  comes  out.  In  the  later  case,  GCS  will  do  the  ranging  again  and 
resend  the  ranging  correction  message  to  the  target.  When  GCS  in  state  qi  receives 
the  Schedule#_Finish  messages  or  Task#_Status_OK  messages,  the  system  will  save 
the  value  of  the  messages,  therefore,  as  soon  as  the  system  jump  back  to  the  previous 
states,  it  can  recall  these  values  and  perform  the  corresponding  operations. 

The  discrete  events  are  grouped  into  input  set  and  output  set  denoted  by  E„,  and  E„u( , 
where 

=  {£/nl>£'m2’£in3’£’m4>f7n5}  = 


Command  _  Paremeters,  Task  #_  Status  _  OK,  Schedule  #_  Finish , 
Ranging  _  Status  _  OK,  Ranging  _  Request 


[GCS _Command,  Ranging  Correction} . 

The  Invariant  set  of  Q  =  {qt  q2  <h  g4}  are  given  as  follows, 
Inv(qt )  =  j( Command _  Parameters  =  0)  a  (Ranging  Request  =  0)} , 

Inv(q2 )  =  [(Schedule  #_  Complete  =  0)  a  (Ranging_Request  =  0)} , 

Inv(qy)  =  [(Task  #_  Status  OK  -  0)  /\(Ranging_Request  =  0)} , 


Inv(qA )  =  {( Ranging  _ Status  _  OK  —  0)} . 


The  discrete  transitions  of  the  system  are: 

E  = 

|  (tfl.ft)  (<72>94)  (^2>^)  (^3^2) 

|L(?3^4)  (?4.?3)  (?3>?l)  (?„?4)  (?4>?l) 


The  guard  conditions  are  given  as: 

(£/,,£/,)  =>  |[(Co/w/na«(3f  _  Parameters  *  0)]j 

(<?2>^4)  =>  =  1)]} 

(</4,<72)  =>  [( Ranging  __ Status _ 6* A"  =  \)v (Ranging _Timeout  =  1 )]j 

(<72,(73)  =>  {[(Sc/iec/M/e #_ Finish  =  1  )]| 

( c/; ,  )  =>  j[(7as£  #_  Status  _  OK  =  0)]j 

(?3»^4 )  =>  {[(/tanging _ Request  =  1)]} 

(  ?4  >  93 )  =>  { [(  Ranging  _  Status  OK  =  1)  v  ( Ranging  _  Timeout  =  1)]} 
(^3,^)^  {[(7as& #_ Status _OK  =  1)]} 

(<7nft)=>  {[(/tang/ng  _  Request  =  1)]} 

(<74,<7,)  =>  {[(/tawg/rtg _ Status _ 6>A'  =  1)  v ( Ranging  _ Timeout  =  1)]| 


Figure  1 .  State  Transition  Diagram  for  Ground  Control  Station 

The  Mother-ship  functions  are  given  as  follows. 

1)  Control  the  Agents  and  Mother-ship  itself  in  a  cluster  to  implement  orbit  and 
attitude  change. 

2)  Receive  the  mission  command  from  GCS,  parse  the  command  for  the  task 
parameters  calculation  including  orbit  parameters  and  attitude  for  each  Agent  and 
MS  itself. 

3)  Communicate  with  other  MSs  to  distribute  the  command  from  GCS  and 
coordinate  the  operation  of  the  different  clusters. 

4)  Schedule  the  tasks  for  each  Agent  in  the  cluster. 


5)  If  all  the  Agents  in  cluster  cannot  schedule  the  task,  MS  will  send  message  to 
other  MSs  so  that  other  MSs  can  resume  the  task,  at  the  same  time  MS  will  send  a 
mission  status  message  back  to  the  GCS. 

Figure  2  shows  the  state  transition  diagram  for  the  Mother-ship.  The  functions  are 
divided  into  two  subsystems.  First  subsystem  is  dealing  with  command  generating  and 
task  scheduling,  which  consists  of  three  states,  q{ ,  q2,  and  q2,  and  the  second  subsystem 
is  MS  orbit  and  attitude  control  system  which  controls  the  orbit  and  attitude  of  MS  itself, 
which  includes  three  states,  qA ,  q5,  and  q6,  where 

•  <7,  :  Idle  State.  In  this  state,  MS  will  monitor  the  command  from  GCS,  if 
GCSCommand  *  0 ,  the  system  will  go  to  q2,  TaskScheduling  State. 

•  q2 :  Task  Scheduling  State.  In  this  state,  the  system  will  analyze  the  GCS  command 

parameters.  If  the  cluster  meets  the  requirements  of  the  GCS  Command,  MS  will 
decompose  the  mission  to  a  series  of  tasks  for  the  components  (Agents  and  Mother- 
ship)  in  the  cluster  by  calculating  the  orbit  and  attitude  parameters  as  well  as  the  task 
start  time  and  end  time  for  each  component.  After  the  mission  is  decomposed,  MS 
will  send  a  tag  called  MS/_Task#_Schedule_OK  to  GCS  to  notify  that  Mother-ship  /' 
has  finished  the  task  scheduling.  And  then,  the  system  will  jump  to  state  q3.  Agent 
Control  State. 

•  q2 :  Agent  Control  State.  In  this  state,  MS  will  control  the  orbit  and  attitude  of  the 

Agents  to  perform  the  scheduled  tasks.  For  each  Agent,  at  the  scheduled  task  start 
time,  MS  will  send  the  orbit  and  attitude  command,  which  we  call 


Ag/'_Task#_Command,  to  the  Agent  j  to  control  the  behavior  of  the  Agent  to  perform 
the  task.  In  q}  state,  MS  also  monitors  the  feedback  messages  from  Agents.  The 
message  is  the  tag:  Ag/'_Task#_Finish  which  indicates  whether  the  Agent  j  has 
performed  the  task  successfully.  If  the  mission  needs  MS  itself  to  perform  the  orbit 
and  attitude  maneuver  at  the  specific  time,  the  system  will  jump  from  q ,  to  r/4,  which 

belongs  to  the  subsystem  named  MS  orbit  and  attitude  control  system  at  the 
scheduled  time. 

q4 :  MSOrbitCheck  State.  In  this  state,  MS  checks  the  status  of  MS jOrbit Attitude 
Command  to  see  if  there  is  a  requirement  to  do  the  orbit  and  attitude  change.  If 
MS  Orbit  Attitude  Command  shows  that  the  current  orbit  and  attitude  do  not  match 
the  command  specifics,  the  satellite  will  jump  to  the  q$  to  start  an  orbit  maneuver  and 
attitude  adjustment. 

q5 :  MS  Attitude  Adjustment  State.  In  this  state,  MS  adjusts  its  attitude  to  the  Euler 
angles  calculated  from  the  MS  Orbit  Attitude  Command  specifics.  It  will  first  check 
the  current  altitude  with  the  target  altitude,  if  the  current  altitude  does  not  match 
target  altitude,  MS  will  adjust  its  attitude  to  thruster  firing  mode  and  jump  to  c/6  to 
perform  an  orbit  maneuver.  Otherwise,  MS  will  check  the  current  attitude  with  the 
calculated  attitude  for  the  task.  If  there  is  a  difference  between  current  attitude  and  the 
calculated  attitude,  MS  will  perform  an  attitude  adjustment,  and  then  it  will  jump 
back  to  q4,  MS  Orbit  Check  State  with  a  tag  that  MS_Orbit_Finish=l . 

q6 :  Orbit_Maneuver  State.  In  this  state  MS  changes  its  altitude  to  the  target  altitude 
determined  by  the  MS  Orbit  Attitude  Command.  If  MS  is  not  in  the  thruster  firing 


mode,  it  will  jump  to  qs  to  change  its  attitude  to  the  thruster  firing  mode  to  boost  the 
satellite  to  the  target  altitude.  If  MS  is  already  in  the  thruster  firing  mode,  it  will 
perform  a  thruster  fire  to  shoot  itself  to  the  target  orbit.  After  performing  the  orbit 
maneuver,  MS  will  jump  back  to  qs  to  adjust  the  Euler  angles  to  reach  target  attitude 
specification. 

The  continuous  variables  only  exist  in  the  MS  orbit  and  attitude  control  subsystem, 
that  is,  they  do  not  affect  states  qx ,  q2  and  q2 .  The  finite  set  of  real  valued  continuous 
variables  for  MS  model  is  defined  as,  X  =  [xx,x2,xi,x^,xi,x(),x1) ,  where  xx  represents  the 
altitude  (h)  of  the  satellite,  x2  represents  angular  velocity  cox,  x2  represents  the  angular 
velocity  Swy,  x4  represents  the  angular  velocity  a>2,  xs  represents  the  roll  Euler  angle  0, 
xb  is  the  pitch  Euler  angle  0,  x7  is  the  yaw  Euler  angle  i// . 

The  controllable  continuous  inputs  are  the  angular  velocities  of  the  four  reaction 
wheels.  U  =  {«,,  u2,  u},  uj,  w,  u2  =Q2,  w3  =fi,,  u4  =&A. 

The  continuous  dynamics  are  specified  as 


f(q4,x,u)  =  [r  ax  8wy  o)z  <j)  0  v  n,  n2  n3  n4]y » 


f(qs,x,u) 


h  -  F  x  At 

I  X  9.2334e-7+<yz  x  2.8937e-4+Q,  x  2. 1753e-8+Q2  x  2.1753e-8+H3  x  2.1753e-8+04  x  2. 1753e-8) 

J  (-0  x  2.2257e-6)  dt 

I  (-^x  x  8.3747e-4-n,  x  3.0565e-8+O2  x  3.0565e-8+O3  x  3.0565e-8-O4  x  3.0565e-8)<// 

/  x  1 ,0636e-3+6>x  )  dt 
j  (  So y  )  dt 

\  (-^  x  1 ,0636e-3+fi>z  )  dt 

f  (-<*  x  5.3309e-7+<9  x  1.285e-6+a>x  x  4.8352e-4-<yz  x  1  6707e-4+n,  x  5.0877e-9-O2  x  3.0205e-8-03  x  3.0205e-8+Q4  x  5.0877e-9W/ 
f  x  5.3309e-7+<9  x  1  285e-6+<yx  x  4.8352e-4+<yz  x  l  6707e-4+Qj  x  3.0205e-8-02  x  5.0877e-9-O3  x  5.0877e-9+O4  x  3.0205e-8)  dt 
J  (</>  x  5.3309e-7-<9  x  1.285e-6+fi>x  x  4.8352e-4+tf>z  x  1  6707e-4+nj  x  3.0205e-8-02  x  5.0877e-9-Q3  x  5.0877e-9+n4  x  3.0205e-sW/ 
1  (-<*  x  5.33O9e-7-0  x  1  285e-6+<yx  x  4.8352e-4-^z  x  1  6707e-4-^!  x  5.0877e-9-O2  x  3.0205e-8-03  x  3.0205e-8+n4  x  5.0877e-9)  dt 


/(VS’*’14) 


a(\  ~  e 2  ) 
1  +  e cos  v 


T 


0000000000 


The  discrete  events  for  MS  are 


-  {^m\  ’  Sin2  ’  Sin3  }  “ 

{GCS  _  Command ,  MSi _  Task  #_  Schedule  _  OK ,  Agi _  Task  #_  Finish} ; 


^ out  =  {  £o\  ’  ^o2  ’  £()3  9  F)4  9  £o5  }  = 

[ GCS _ Command,  MSi _T ask#  Coordinator,  Agj  Task#  Command, 
{  MSi  _  Task  #_  Schdule  _  Finish ,  MSi  _  Task  #_  Finish 


The  Invariant  set  of  Q  =  {qx  q2  q3  qA  q5  q6  q2)  are  given  as  follows, 


Inv{qx)  -  [GCS  Command  -  0} , 


Inv(q2)  = 


|  Wait  until  MSj  _  Task  #_  Schedule  _  OK  tags  are  received 
[  from  j  =  0,  1,...,  n,  j  *  i,n  is  the  number  of  clusters. 


Inv(q^)  = 


f  Wait  until  all  Agj  _  Task  #_  Finish  tags  are  received 
I  from  j  =  0,  1,...,  m,  m  is  the  number  of  Agents  in  the  cluster  i. 


Inv(qA)  = 


lx  e  K7  :  (x5  =  TargetRoll,x6  =  TargetPitch,x1  =  TargetYaw ) 
At  <  MS _ Orbit _ Command _ Time 


Inv(q5)  =  jx  e  R7  :  x5  *  CalculatedRoll, xb  *  Calculated  Pitch,  x7  *  CalculatedYaw j , 


Inv(qb)  =  jx  e  R7  :  x,  *  Target  Altitude} . 

The  discrete  transitions  of  the  system  are: 

(<7p<7:)  (ft.  0s)  (9j»?4) 

(94>?3)  (94’?5)  (95^4)  (?5>?6)  (?6>?s) 


The  guard  conditions  are  given  as 


G, 

G, 

g3 

g4 

g5 

g6 

g7 

Gs 

g9 


)  = 

(^.94  )! 
(^4.9j): 

(fc.fc)1 


(^W4): 

(<75,<76); 

(<76-<75): 


>  [GCS  Command  *  0} 

>  { A/S/ _ 705* #_ Schedule _ OK  =  1  /or  /  =  1,  2, 
J  Agj  _  Task  #_  Finish  =  1  ybr  /  =  1,  2,  /wl 

|  a  MS  _  Orbit  _  Finish  =  1 

>  | x  e  R1 :  (/  >  MS _ Orbit  _Command _ Time) j 

>  { MS  _  Orbit  _  Finish  =  1} 


»} 


x  e  R7 :  (jc5  *  CalculatedRoll , 


1 


jc6  *  Calculated? itch,  x7  *CalculatedYaw)\ 


xe  \ 


x5  =  CalculatedRoll, 


vjc6  =  Calculated?  itch,  x7  =  CalculatedYaw 
a  (x,  >  Target  _  Altitude) 

|jc  e  IR7 :  (|jc,|  >  Target  Altitude  +  2000)} 
jx  e  R7 :  (|jc,  |  <  Target  _  Altitude  +  2000) j 


Figure  2.  State  Transition  Diagram  for  the  Mother-ship  No./ 
The  Agent  functions  are  as  follows. 


1)  Receive  orbit  and  attitude  commands  from  MS. 

2)  Perform  the  orbit  maneuver  and  attitude  change  for  the  scheduled  tasks. 

3)  Send  the  task  status  feedback  to  MS  to  notify  whether  the  task  is  successful. 

4)  Switch  to  MS  in  the  case  that  the  MS  malfunctions,  this  operation  is  done 
autonomously  by  the  Agents  in  that  group  via  certain  election. 


Agj_T  ask#_Command=0 


(CurrentAltitude  ^ 
TargetAltitude) 


(x5*a,  xe^b,  x7^t  c) 


Figure  3.  State  transition  diagram  for  Agent  control  system. 


The  agent  control  system  is  indeed  the  same  as  the  MS  orbit  and  attitude  control 
subsystem  in  the  way  that  they  both  control  the  satellite  to  perform  the  orbit  maneuver 
and  attitude  adjustment.  Therefore,  Agent  control  system  consists  of  three  states,  qx,  q2, 

and  q3 ,  where 


•  <7,  :  Idle  State.  In  this  state,  Agent  will  monitor  the  command  from  MS,  if 
Agj _ Task #_ Command  *  0,  and  the  current  orbit  and  attitude  are  different  from  the 
command  specifics,  the  satellite  will  jump  to  the  q2  to  start  an  orbit  maneuver  and 
attitude  adjustment. 

•  q2  :  AttitudeAdjustment  State.  In  this  state,  Agent  will  analyze  the 
Agj _ Task #_ Command  parameters  including  target  position  and  target  attitude.  If 
there  is  a  requirement  for  the  orbit  maneuver  and  attitude  adjustment.  Agent  will 
calculate  the  Euler  angles  from  Agj _Task#  Command  parameters.  Then,  it  will 


check  the  current  altitude  with  the  target  altitude,  if  the  current  altitude  does  not 
match  target  altitude.  Agent  will  adjust  its  attitude  to  thruster  firing  inode  and  jump  to 
q3  to  perform  an  orbit  maneuver.  If  current  altitude  matches  the  target  altitude.  Agent 
will  check  the  current  attitude  with  the  calculated  attitude  for  the  task.  If  there  is  a 
difference  between  current  attitude  and  the  calculated  attitude.  Agent  will  perform  an 
attitude  adjustment  in  q2 ,  and  then  jump  back  to  qi.  Idle  State,  with  a  tag  that 
Agent_Orbit_Finish=l . 

•  q3 :  Orbit_  Maneuver  State.  In  this  state,  Agent  changes  its  altitude  to  the  target 
altitude  specified  in  the  Agj  Task  #  Command .  If  Agent  is  not  in  the  thruster  firing 
mode,  it  will  jump  to  q3  to  change  its  attitude  to  the  thruster  firing  mode  to  boost  the 
satellite  to  the  target  altitude.  If  Agent  is  already  in  the  thruster  firing  mode,  it  will 
perforin  a  thruster  fire  to  shoot  itself  to  the  target  orbit.  After  performing  the  orbit 
maneuver,  MS  will  jump  back  to  q3  to  check  the  current  attitude  and  the  target 
attitude  specification. 

The  continuous  variables  of  the  Agent  control  system  affect  states  qx ,  q2  and  q2 .  The 

finite  set  of  real  valued  continuous  variables  for  Agent  model  is  defined  as, 
X  =  {x\,x1,xl,x4,xi,xb,x1)  ,  where  x,  represents  the  altitude  (h)  of  the  satellite,  x2 

represents  angular  velocity  cox,  x3  represents  the  angular  velocity  Smv,  x4  represents  the 
angular  velocity  co. ,  x5  represents  the  roll  Euler  angle  </> ,  x6  is  the  pitch  Euler  angle  0, 
x7  is  the  yaw  Euler  angle  ij/  . 

The  controllable  continuous  inputs  are  the  angular  velocities  of  the  four  reaction 
wheels.  U  =  {«,,  u2,  u},  «4},  w,  =f},  u2  =  Qj,  m3  =Q,,  w4  =Q4. 


The  continuous  dynamics  are  specified  as 


/(gp *,w)  =  [/  (ox  S(oy  co2  <!>  6  v  Q,  q2  o3  n4]7 


/(^2 .  jr,  m) 

h-FxAt 

\  x  9.2334e-7+<yz  x  2.8937e-4+Qj  x  2.1753e-8+n2  x  2.1753e-8+H3  x  2.1753e-8+Q4  x  2.1753e-8)rf/ 

|  (-0  x  2.2257e-6)  dt 

\  (-fi>x  x  8.3747e-4-Qj  x  3.0565e-8+O2  x  3.0565e-8+O3  x  3.0565e-8-H4  x  3.0565e-8^/ 

\  (y/  x  1 ,0636e-3+<yx  )  dt 

=  J  (  ScOy  )  dt 

J  x  1 .0636e-3 +coz  )  dt 

I  (-^  x  5.33O9e-7+0  x  1.285e-6+wx  x  4.8352e-4-^z  x  1.6707e-4+Oj  x  5.0877e-9-O2  x  3.0205e-8-03  x  3.0205e-8+n4  x  5.0877e-9 )dt 
I  x  5.33O9e-7+0  x  1 285e-6+<yx  x  4.8352e-4+<yz  x  1 ,6707e-4+Oj  x  3.0205e-8-Q2  x  5.0877e-9-O3  x  5.0877e-9+n4  x  3.0205e-8)  dt 
J  (y  x  5.33O9e-7-0  x  1.285e-6+tf>x  x  4.8352e-4+ft>z  x  1.6707e-4+nj  x  3.0205e-8-02  x  5.0877e-9-Q3  x  5.0877e-9+Q4  x  3.0205e-8 )dt 
1  (-^  x  5.33O9e-7-0  x  l.285e-6+fi>x  x  4.8352e-4-^z  x  1 ,6707e-4+Oj  x  5.0877e-9-O2  x  3.0205e-8-03  x  3.0205e-8+04  x  5.0877e-9 Jdt 


f(q3,x,u) 


a(l-e2) 
1  +  e cos  v 


T 


0000000000 


The  discrete  events  for  the  Agent  control  system  are 
£/„  =  {sinl }  =  { Agi  _  Task  #_  Command } 


=  Ri }  =  {  Asi  _  Task  #_  Finish) 


The  Invariant  set  of  Q  =  {q{  q2  q2)  are  given  as  follows, 


Inv(q] )  =  { Agj  _  Task  #_  Command  =  0} , 


Inv(q2)  =  g  K7  :(x5  ^  CalculatedRoll,x6  *  CalculatedPitch, x7  *  CalculatedYaw)}, 


Irtv(q} )  =  Inv(q6)  =  |jc  e  M7  :  xt  *  TargetAltitude J  . 


The  discrete  transitions  of  the  system  are: 

£  =  {[(ft>ft)  (ft.ft)  (ft. ft)  (ft.ft)]}- 


The  guard  conditions  are  given  as 


{q^q2)  =>  [Agj  _Task#_Command  *  0} 

Gx 

.  N  \x  e  R7 :  (x,  =  TargetAltitude)  a  (x5  =  TaregetRoll )1 

- < 

(q^qii^i  r 

[a(jc6  =  TargetPitch)  a  (jc7  =  TargetYaw)  J 

Gl 

ga 

(q2,q3)  =>  |jc  g  R7 :  (|jc,|  >  Target  Altitude  +  2000)} 

L  4  J 

(<73 > )  =>  { *  G  :  (|*i  |  -  Target  _  Altitude  +  2000)} 

Forward  Reachable  Set  of  the  Satellite  Hybrid  Systems 

Reachability  is  a  concept  of  hybrid  systems  which  states  that  a  certain  state 
(q’  ,x')e  Qx  X  can  be  reached  from  an  initial  set  of  states  through  a  finite  execution. 
Formally,  a  state  (q‘,x')  e  QxX  is  reachable  if  there  exists  a  finite  execution 
£H(j,q,x,t,a,b,Sa,8b)  €  SH  from  the  initial  state  {q„,xo)  such  that 
£H(j,q,x,t’  ,a,b,8a,8b)  =  (q‘,x‘).  Where  sH  is  the  set  of  all  executions  of  H , 

£h  (r,qo,xo,t’  ,a,b,8a,Sb)  is  one  of  the  finite  execution  of  SH  .  r  is  the  hybrid  time 
trajectory,  r  =  {[r,,r,  ']}*„  or  {[r,,r,  U[rN,rN  ’)  with  Ncoo.  /’er  is  the  time  when 
the  system  reaches  the  state  (q‘ ,x") ,  a  is  the  input,  A  is  the  set  of  all  inputs,  b  is  the 
disturbance,  B  is  the  set  of  all  disturbances,  8a  is  discrete  input,  is  the  set  of  all 
discrete  inputs,  8h  is  discrete  disturbance,  andXA  is  the  set  of  all  discrete  disturbances. 
Then  the  set  of  reachable  states  can  be  represented  as 


Reach'  =  K’*  } 6  QxX  1 6  ByS»  6  e  £„. 

[3  (r,  q,  x,  t,  a,  b,  Sa ,  Sb )  e  sH ,  such  that  £H  (r,  q,  x, /’ ,  a, b,  Sa ,  Sb  )  =  (q* ,  x* ) ] 

Existence  and  Uniqueness  of  the  Executions  in  a  Satellite  Hybrid 
System 


To  determine  whether  an  execution  of  a  hybrid  system  exists  and  is  unique,  we  need 
to  determine  the  non-blocking  property  and  the  deterministic  property  of  the  execution. 

For  the  non-blocking  property  of  the  executions  in  the  hybrid  systems,  we  will  use 
the  definition  of  the  forward  reachable  set.  We  define  another  concept,  the  transition  set. 
The  transition  set  stands  for  a  set  where  the  continuous  evaluation  is  impossible.  It  can  be 
expressed  as 

Uq*,x*)eQxX\VbeB,VSbe'Lb,VaeA,VSae'La, 

Trans  H  = 

[Vf>0,3/"  e[0,£),such  that  CH{r,q  ,x,t*’ ,a,b,Sa,Sb)<£  Inv(q’) 
where  £H(r,q  ,x,t" ,a,b,Sa,Sb)eeH  is  an  arbitrary  execution  which  starts  from 
( q*,x *)  and  Inv(q")  is  the  invariant  set  of  the  state  q * . 

The  non-blocking  property  is  defined  as  follows.  A  hybrid  system  is  non-blocking  if 
for  all  (q0,x0)e  Init ,  at  least  one  infinite  execution  £„(r,q,x,t,a,b,5a,Sh)  e  SH  exists, 

which  starts  from  the  initial  state  (qo,xa) .  Here  the  hybrid  time  trajectory  r  is  inifite. 

The  following  lemma  can  be  used  to  determine  the  non-blocking  property  of  a 
hybrid  system. 

Lemma  /:  A  hybrid  system  H  is  non-blocking  if  for  all 
(q,  x)  e  Reach H  f|  Trans H ,  there  exists  an  infinite 

execution £H(r,q,x,t, a, b,5a,Sh)  =  (g’,*’),  such  that(g,  q‘)e  £and 

{xM,b,Sa,5b}£G(q,q’) . 

Here  E  is  the  edge  of  the  hybrid  system  and  G  is  the  guard  condition  of  the  transition 
of  the  hybrid  system. 

The  deterministic  property  of  an  execution  of  a  hybrid  system  is  determined  by  the 
following  lemma. 


Lemma  II:  A  hybrid  system  H  is  deterministic  if  and  only  if  for  all  ( q,x )  e  ReachH, 


1)  if  (x,a,b,Sa,Sb)eG(q,q")  for  some  (q,q')eE,  then  ( q,x)  e  Trans H ; 

2)  if  (q,q*)e  E  and  ( q,q")eE  with  q  *q*\  then  (x,a,b,Sa,Sb)eG(q,q’)C\G(q,q"y, 

3)  if  (q,q*)eE  and  (. x,a,b,Sa,Sb)eG(q,q '),  then  R(q,q’,x)  cotains  at  most  one  element. 


Now,  we  present  the  theorem  to  determine  the  existence  and  uniqueness  of  the 
hybrid  system,  H. 

Theorem  I:  If  a  hybrid  system,  H,  satisfies  Lemma  I  and  Lemma  II  above,  then  H 
accepts  a  unique  infinite  execution  for  all  (q„,x0)  e  InitH . 


Backward  Reachable  Set  of  the  Satellite  Hybrid  Systems 


The  backward  reachable  set  means  that  the  system  starts  from  the  final  set  of  states, 
then  follows  some  certain  executions  to  go  back  and  find  the  previously  visited  set  of 
states.  This  set  of  states  is  called  backward  reachable  set.  Let  the  final  set  be  the  set  at 
time  /= 0,  then  the  backward  reachable  set  Reach^  is  the  set  of  states  at  time  /’  e  [-7\0]. 


ReachhH 


\q\x)  eQxX,\Vbe  B,\/Sb  e  e  A,35a  e 
<  3/*  e  [-T,  0] ,  CH  (r>  <L  L  a,  b,  Sa ,  S„ )  e  sH , 
such  that  gH(T,x,q,t' ,a,b,Sa,Sb)  e(q' ,x‘) 


Where  a  is  the  controllable  input,  b  is  the  uncontrollable  input,  r  is  the  hybrid  time 
trajectory,  is  the  executions  of  //which  starts  from  the  final  set,  q  is  the  discrete  states. 


jc  is  the  continuous  state  variable,  5a  is  discrete  controllable  inputs  and  5b  is  discrete 
uncontrollable  input. 

One  application  of  the  backward  reachability  research  is  to  calculate  the  unsafe  set 
for  the  collision  avoidance  applications. 


Satellite  Collision  Avoidance  Example 

The  satellite  collision  avoidance  model  is  similar  to  the  aircraft  conflict  resolution 
model  introduced  by  C.  Tomlin  and  I.  Mitchell  etc.  [1-4],  We  define  two  types  of  zones 
for  the  satellite.  One  zone  is  called  the  unsafe  zone,  and  the  other  is  warning  zone. 

The  unsafe  zone  is  a  circular  area  with  the  satellite  at  the  center  with  a  certain  radius. 
The  unsafe  zone  defines  the  area  where  the  target  satellite  has  a  considerably  high 


probability  of  collision  with  other  objects  in  the  same  area.  In  this  model,  we  assume  that 
once  an  object  enters  the  unsafe  zone  of  the  satellite  then  the  collision  is  inevitable. 
Therefore,  the  collision  avoidance  maneuver  of  the  satellite  is  to  control  the  motion  of  the 
satellite  in  order  to  keep  all  other  objects  from  entering  the  unsafe  zone. 

The  warning  zone  is  an  area  which  contains  the  current  position  of  the  satellite. 
When  there  is  another  object  presenting  within  this  zone,  the  satellite  should  take 
collision  avoidance  maneuver  immediately  otherwise  the  object  will  enter  the  unsafe 
zone  after  a  certain  time.  The  shape  and  the  area  of  the  warning  zone  depend  on  orbital 
parameters  of  the  satellite  and  the  incoming  object  and  the  responding  time  of  the  satellite. 
It  should  be  noted  that  because  the  satellite  velocity  changes  with  respect  to  satellite 
position,  the  warning  zone  may  also  change  according  to  the  orbit. 

In  our  satellite  collision  avoidance  example,  we  name  the  satellite,  which  is  trying  to 
avoid  the  collision,  as  the  evader,  and  the  incoming  object,  which  is  trying  to  cause  the 
collision,  as  the  pursuer.  We  assume  the  evader  does  not  have  the  knowledge  about  the 
orbit  of  the  pursuer  but  evader  can  monitor  the  instantaneous  pursuer  position  and 
velocity,  which  can  be  detected  either  by  the  evader  itself  or  by  the  ground  control  station 
which  notifies  the  evader.  Because  we  cannot  predict  the  orbit  of  the  pursuer,  we  define 
a  circular  area  as  the  warning  zone.  The  radius  of  the  warning  zone  depends  on  the 
maximum  possible  detected  velocity  of  the  pursuer  and  the  responding  time  of  the  evader. 
Then,  the  evader  determines  the  collision  avoidance  maneuver  according  to  the  position 
and  the  velocity  when  pursuer  enters  the  warning  zone. 

Next  we  will  explain  how  the  collision  avoidance  maneuver  is  determined  by  the 
evader.  The  goal  for  the  evader  is  to  keep  the  pursuer  from  entering  the  unsafe  zone. 
Therefore,  we  set  the  unsafe  zone  as  the  final  set,  then  compute  the  backward  reachable 
set  which  starts  from  the  unsafe  zone  for  a  certain  time  interval.  This  interval,  which 
ensures  that  the  evader  has  enough  time  to  respond  to  avoid  the  pursuer,  is  chosen  as  ten 
seconds.  We  shall  see  this  ten  seconds  responding  time  is  enough  for  the  collision 
avoidance  in  the  later  section.  Then,  we  choose  the  radius  of  the  warning  zone  so  that  the 
warning  zone  can  cover  all  the  ten  seconds  backward  reachable  set.  Then,  for  any  pursuer 
which  enters  the  warning  zone,  the  evader  has  at  least  ten  seconds  to  perform  the 
collision  avoidance  maneuver.  Because  we  do  not  know  the  orbital  characteristics  of  the 


pursuer,  we  assume  that  when  the  pursuer  enters  the  warning  zone  of  the  evader,  the 
velocity  vectors  of  the  pursuer  and  the  evader  do  not  change  with  time.  This  assumption 
is  reasonable  because  when  we  consider  the  motion  of  a  LEO/MEO/GEO  object,  which 
has  an  orbital  period  of  several  hours,  or  days,  then,  in  a  short  time  period,  i.e.  ten 
seconds,  the  change  of  the  orbital  velocity  (speed  and  direction)  is  very  small  and  can  be 
viewed  as  unchanged. 

Then,  we  need  to  find  a  way  to  mathematically  describe  the  relation  between  evader 
and  the  pursuer.  Because  both  the  warning  zone  and  the  unsafe  zone  are  defined  with 
respect  to  the  evader,  we  model  the  system  using  a  relative  coordinates  with  the  position 
of  evader  as  origin,  the  direction  of  the  evader  linear  velocity  as  the  x  axis,  the  y  axis  is 
counterclockwise  90  degrees  to  the  x  axis.  The  position  of  the  pursuer  then  can  be 
represented  in  the  relative  coordinates  xr  and  yr.  The  angle  y/r  represents  the  difference  of 

the  velocity  vector  from  the  pursuer  to  the  evader.  The  radius  of  the  unsafe  circle  of 
evader  is  Ru.  Using  these  relative  coordinates,  the  parameters  and  the  relation  between 
evader  and  the  pursuer  are  shown  in  the  Figure  1 . 


Figure  1  Evader  and  pursuer  in  relative  coordinates 


To  simplify  the  problem,  we  make  the  following  assumptions.  The  evader  has  a 
circular  orbit.  The  pursuer  and  the  evader  inclinations  are  equal  to  each  other,  meaning 
that  they  are  in  the  same  orbital  plane.  The  evader  collision  avoidance  maneuver  can  be 
performed  by  changing  the  original  orbit  of  the  evader.  In  our  example,  we  implement  the 
orbit  change  by  adding  a  Av  to  the  evader  velocity  va ,  and  the  Av  is  the  control  input  to 


the  system. 

The  satellite  dynamics  in  the  relative  coordinates  can  be  represented  by  the 
following  equations: 

=  v.cosO/zJ-v, 

\yr  =  vb  sin(i//r) 

where 


(1) 


xr,yreR2,  y/r  e[0,2  n),  vaeVa=  [va  -  Av,  va  +  Av],  »t6f(=[»talvJ,  va,v„eR, 


Ra  is  the  distance  from  the  earth  center  to  the  evader,  Av  is  the  velocity 


control  input,  vh  is  the  observed  pursuer  instantaneous  velocity  which  fluctuates  in  a 


range  [vtmax, v4min],  y/r  is  the  angle  between  the  pursuer  velocity  and  evader  velocity,  all 
variables  are  used  as  scalars  in  (1). 

The  backward  reachable  set  can  be  calculated  using  the  level  set  method  discussed 
in  [4],  we  define  a  value  function  </>(x,t)  ,  which  satisfies  the 

condition  0)  =  l(x)  =  x2r  +  y2r  -R2,xeR2 ,  meaning  that  at  the  final  time  t=0,  the  value 
function  should  represent  the  area  of  the  unsafe  zone.  Then,  the  zero  sublevel  set  of<p, 
which  describers  the  unsafe  zone  of  the  evader,  is  the  backwards  reachable  set  [4],  We 
useG(r)to  denote  the  backward  reachable  set,  and  G(r)is  given  by 


G(r)  =  {*  e  M”  |  </>{x,t)  <  0},  where  t=-r.  (2) 

From  equation  (2)  we  notice  that  the  backward  reachable  set  G(r)  is  determined 
once  we  find  the  value  function  <f>(x,t) .  We  use  Level  Set  method  which  is  discussed  in 
detail  in  [4]  to  calculate  </>{x,t) . 


The  dynamics  of  the  value  function  </>(x,t)  can  be  presented  in  a  Hamilton-Jacobi 


equation. 


D,^(x,/)  =  -min{0,  H(x,Dt<f>(x,t))},  for  f  e[-7\0],  xeR”; 


(3) 


Because  the  reachable  set  is  non-decreasing  backwards  with  time,  therefore,  in  (3), 
we  use  min{0,  H(x,DK<f>(x,t))}  instead  of  H(x,Dx</>(x,t)) to  ensure  that 

</>(x,t2)<  <f>(x,tt),  for  /,  <  t2  <  0. 

Let  p  =  Dt/>(x,t ) ,  then,  we  find  that  the  Hamiltonian 


H  (x,  p)  =  ma*  nji  pTf(x,  va,vh). 


(4) 


The  maxmin  sign  in  (4)  indicates  that  the  evader  control  input,  which  is  contained 
in  va ,  always  tries  to  maximize  the  Hamiltonian,  while  the  pursuer  always  tries  to 

minimize  the  Hamiltonian. 

Combining  equation  (1)  and  (4)  we  have 


(5) 


Let  switch  functions  5,  =-/>,;  s2  =  pt  cos(ipr)  +  p2  sin(^r),  then,  we  can  find  the 
optimal  va  and  vh ,  that 


v 


Plugging  v‘  and  v*  into  (5),  we  can  find  the  Hamiltonian.  After  the  Hamiltonian  is 

determined,  we  can  use  the  MATLAB  Level  Set  toolbox  created  by  Ian  Michael  [4]  to 
find  the  solution  of  the  Hamilton-Jacobi  equation  (3),  then  the  backward  reachable  set 
G(r)can  be  determined  by  the  equation  (2). 

Now  we  show  an  example  to  illustrate  how  this  evader-pursuer  collision  avoidance 
model  works. 


Assuming  evader  is  in  the  low  earth  orbit  with  an  altitude  600km,  then 
Ra  =  Rearlh  +  Altitude  =  6371  +  600  =  697 1  Arm  ,  then 


0}a  =  ^7  =  = 1  • 1 77g - 6(rad/s),  va  =  ^/^- =  7.56(km/s) ,  assuming  Av  =  2(km/s), 

the  velocity  of  pursuer  is  v6  =[v6max,vAni|n]  =  [9.25(krn/s),10.25(km/s)],  the  radius  of  the 
unsafe  zone  is  Ru  =  1 0 km .  We  use  the  Level  Set  toolbox  to  calculate  the  ten  seconds 
backward  reachable  set  for  i//r  from  [0,2;r).  The  shadowed  area  in  Figure  2  illustrates  the 
backward  reachable  set  of  the  evader. 


Figure  2.  Backward  reachable  set  of  the  evader  for  y/r  from  [0, 2 n) 


Then  we  will  explain  how  the  collision  avoidance  mechanism  takes  effect  using  the 
backward  reachable  set  knowledge  through  a  specific  example.  Assuming  that  the  angle 


n 


\fjr ,  at  the  time  when  pursuer  enters  the  ten  seconds  backward  reachable  set,  is  y/.  =  — . 


n  . 


We  pick  up  the  hatch  envelop  at  y/r  =  —  in  Figure  2.  The  hatch  envelop  shows  the  ten 

seconds  backward  reachable  set  of  the  evader  for  y/r  =-j.  The  shadowed  area  in  Figure 

3  is  the  final  unsafe  set  of  the  evader  at  the  ending  time  t=0s.  The  shadowed  area  in 
Figure  4  shows  the  backward  reachable  set  at  t=-10s  (because  we  start  from  t=0s  and 


compute  the  backward  reachable  set,  therefore  the  ten  second  reachable  set  is  actually  at 
t=-10s). 

From  Figure  4,  we  know  that  if  the  pursuer  is  in  the  reachable  set  of  the  evader,  then, 
the  pursuer  will  reach  the  unsafe  zone  of  the  evader  in  at  most  ten  seconds.  Therefore,  to 
avoid  the  collision,  the  action  taken  by  evader  should  move  the  reachable  set  out  of  the 
position  where  the  pursuer  is. 


t  = 


Figure  3.  Unsafe  zone  for  evader  at  t=0s 


t  = 


In 


7t 


Figure  4.  Backward  reachable  set  for  evader  at  /=-10s 
Figure  5,  we  keep  the  envelop  of  the  backward  reachable  set  for 

(illustrated  in  bold  dashed  line),  and  add  another  envelop  for  the  backward 


n 


reachable  set  at  y/r  -  —  (illustrated  in  solid  line).  In  the  above  example,  if  the  evader 
6 


detects  the  pursuer  is  at  position  A  in  the  Figure  5,  which  is  unsafe  for  the  evader  if  it 
does  not  take  any  action.  The  two  objects  will  collide  after  ten  seconds  because  that  the  A 

point  is  within  the  ten  seconds  backward  reachable  set  at  y/r  =  y  .  The  ten  seconds 


71 

backward  reachable  set  for  y/r  =  —  is  shown  in  solid  line  in  Figure  5.  The  point  A  is  out 

6 

of  this  set.  Also,  we  notice  that  two  reachable  sets  are  partially  overlapped  which  is 
marked  by  the  cross-line  shadow  in  Figure  5.  The  above  information  indicates  that  the 

71  71 

shadowed  area  without  cross-line  is  unsafe  for^r  =  — ,  but  is  safe  for  y/r=  — ,  therefore, 

3  6 


when  the  pursuer  enters  the  shadowed  area  at  point  A,  the  evader  predicts  that  the  pursuer 


its  orbit  by  casting  a  proper  Av  to  the  original  velocity  to  change  the  angle  y/r  such  that 
y/r  =  —  .  Because  that  the  A  point  is  not  in  the  ten  seconds  backward  reachable  set  for 


6 


n 


i//r  =  — ,  it  will  not  enter  the  unsafe  zone  of  the  evader  after  ten  seconds,  hence  the 
6 

collision  is  avoided.  It  should  be  noted,  because  two  reachable  sets  are  partially 
overlapped,  if  the  pursuer  is  in  the  overlapped  area  of  both  sets,  then  whatever  the 

y/r  =  —  or  if/r  =  — ,  the  collision  cannot  be  avoided.  To  avoid  the  collision,  a  different  Av, 
3  r  6 

which  can  move  the  backward  reachable  set  of  the  evader  out  of  the  current  position  of 
the  pursuer,  is  necessary  to  be  added  to  the  evader  velocity.  This  example  demonstrates 
how  we  can  use  the  backward  reachability  property  to  perform  the  collision  avoidance 
maneuver  between  the  evader  and  the  pursuer. 
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Figure  5.  Evader  changes  the  velocity  to  avoid  the  potential  collision 


Stability  of  a  Hybrid  System 


To  study  the  stability  property  of  the  hybrid  system,  we  first  define  the  equilibrium 
point  of  a  hybrid  system. 

Definition  1  (Equilibrium  Point):  For  a  hybrid  system  H,  a  point  x  =  0  is  an 
equilibrium  point  of  H  if  and  only  if  it  satisfies  the  following  conditions. 

1.  If  x-0iG(q,q'),  then  f(q,x,a,b,8a,8h)  =  0  for  all  q  e  Q  when 

a  =  b  =  Sa  =  Sh  =  0  ; 

2.  Ifx  =  OeG(<7,<7'),  then  ^,^’,0)  =  {0}. 

Here  we  note  that  the  equilibrium  point  is  not  necessarily  at  x  =  0 ,  it  can  be  any 
point  and  we  use  the  same  method  to  analyze  the  stability  property  of  the  equilibrium 
point. 

Then,  the  definition  of  stability  of  an  equilibrium  point  is  described  as  follows. 

Definition  2  (Stable  Equilibrium):  Assume  x  =  0  is  an  equilibrium  point  of  the 
hybrid  system  H ,  then,  x  =  0  is  stable  if  for  any  e  >  0 ,  there  exists  a  8  >  0  such  that  for 
any  execution  CH(t, q,x,t, a, b, 8a,8b) that  starts  from  (q0,x0),  if  ||jt0||  <  8 ,  ||jc(f)||  <  e  for 
all  t  st. 

Definition  3  (Asymptotically  Stable  Equilibrium):  Assume  x  =  0  is  an  equilibrium 
point  of  the  hybrid  system  H,  then,  x  =  0  is  asymptotically  stable  if  there  exists  a 
8  >  0  such  that  for  any  execution  £H{r,q,x,t,a,b,8a, 5h)  that  starts  from  (q0,x0),  if 

||jc0|| <8 ,  lim ||jc(0||  =  0  . 

According  to  Branicky  [5],  the  stability  property  can  be  determined  using  multiple 
Lyapunov  functions.  For  our  hybrid  system  model  which  is  defined  at  the  beginning  of 
the  paper,  we  have  the  following  theorem. 

Theorem :  Consider  a  hybrid  system  H  with  the  equilibrium  jc=0,  \Q\  <  oo ,  and 

R(q, q ', x)  -  {x} .  For  each  q,  we  consider  an  open  set  D^  c  X ,  such  that x-Oe  D^.  If 


there  exists  a  function  Vq,  which  is  continuously  differentiable  in  x,  satisfies  the  following 
conditions: 

1.  Vq(q,0)= 0, 

2.  Vq  (q,x)> 0  for  all  xe  Dq\{ 0} , 
dV 

3.  — ~(q,x)f(q,x)  <  Ofor  allxe  D . 
dx 

And  if  for  all  (r  ,q,x,a,b,Sa,Sh)  e  H,  and  all  q'  e  Q,  if  q{r.)  =  q',  then 
Vq,  (q\x)<  F  (q,x),  in  other  words,  the  sequence  {Vll(q(Tl),x(Ti)):q(ri)  =  q'^  is  non¬ 
increasing,  then  x=0  is  a  stable  equilibrium  of  H. 
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